All vulnerabilities
CVE-2026-82231

Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client

Apache Software Foundation Apache bRPCFrameworks
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.18.0Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::length_error). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC.

This is the client response path, so the adversary is the server peer, which THREAT_MODEL.md treats as untrusted. It requires a WITH_THRIFT build (off by default).

How to Fix:

  1. Upgrade bRPC to version 1.18.0, which fixes this issue.
  2. Apply this patch: https://github.com/apache/brpc/pull/3500

Text from CVE List

Affected versions 1

  • Apache bRPCaffected: all versions before 1.18.0CVE List

References 1